amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-08-12 10:23:19 +00:00
Code Issues Projects Releases Wiki Activity

fix(mail): escape angularJS directive for description

Browse Source
This commit is contained in:
Hivert Quentin
2026-08-10 19:34:25 +02:00
parent 78807d01ae
commit 47133fdf3b
19 changed files with 38 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SoObjects/SOGo/NSString+Utilities.h
+2 -1
View File
@@ -78,7 +78,8 @@
/* XSS protection */
- (NSString *) removeHTMLTagsExceptAnchorTags;
- (NSString *) stringWithoutHTMLInjection: (BOOL)stripHTMLCode;
- (NSString *) stringWithoutHTMLInjection: (BOOL)stripHTMLCode
stripAngular: (BOOL)stripAngular;
#ifndef GNUSTEP_BASE_LIBRARY
- (BOOL) boolValue;
SoObjects/SOGo/NSString+Utilities.m
+17 -1
View File
@@ -936,7 +936,7 @@ static int cssEscapingCount;
* @param stripHTMLCode Remove all HTML code from content
* @return A safe string
*/
- (NSString *) stringWithoutHTMLInjection: (BOOL)stripHTMLCode
- (NSString *) stringWithoutHTMLInjection: (BOOL)stripHTMLCode stripAngular: (BOOL)stripAngular
{
NSString *result, *text, *newResult;
NSScanner *theScanner;
@@ -1058,6 +1058,22 @@ static int cssEscapingCount;
// Remove @import css (in style tags)
regex = [NSRegularExpression regularExpressionWithPattern:@"(<[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*s[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*t[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*y[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*l[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*e.*)([\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*@[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*i[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*m[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*p[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*o[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*r[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*t)(.*<[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*\\/[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*s[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*t[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*y[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*l[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*e[\\s\\u200B&#x09;&#x0A;&#x0D;\\\\0]*>)"
options: NSRegularExpressionCaseInsensitive error:&error];
newResult = [regex stringByReplacingMatchesInString:result options:0 range:NSMakeRange(0, [result length]) withTemplate:@"onrep***="];
result = [NSString stringWithString: newResult];
if(stripAngular) {
// Remove {{ and }} as they are interprated by angularJS with no way of escaping
regex = [NSRegularExpression regularExpressionWithPattern:@"(\\{\\{)|(&#x7b;&#x7b;)"
options: NSRegularExpressionCaseInsensitive error:&error];
newResult = [regex stringByReplacingMatchesInString:result options:0 range:NSMakeRange(0, [result length]) withTemplate:@"{\\\\{"];
result = [NSString stringWithString: newResult];
regex = [NSRegularExpression regularExpressionWithPattern:@"(\\}\\})|(&#x7d;&#x7d;)"
options: NSRegularExpressionCaseInsensitive error:&error];
newResult = [regex stringByReplacingMatchesInString:result options:0 range:NSMakeRange(0, [result length]) withTemplate:@"}/}"];
result = [NSString stringWithString: newResult];
}
newResult = result;
while([regex numberOfMatchesInString:newResult options:0 range:NSMakeRange(0, [newResult length])] > 0) {
newResult = [regex stringByReplacingMatchesInString:newResult options:0 range:NSMakeRange(0, [newResult length]) withTemplate:@"$1@im****$3"];
SoObjects/SOGo/SOGoAdmin.m
+1 -1
View File
@@ -93,7 +93,7 @@ static const NSString *kCacheMotdKey = @"admin-motd";
NSException *error;
NSString *safeMotd;
safeMotd = [motd stringWithoutHTMLInjection: NO];
safeMotd = [motd stringWithoutHTMLInjection: NO stripAngular: NO];
error = [[[GCSFolderManager defaultFolderManager] adminFolder] writeMotd: safeMotd];
if (!error) {
[[SOGoCache sharedCache] setValue:safeMotd forKey:kCacheMotdKey];
SoObjects/SOGo/SOGoUserDefaults.m
+2 -2
View File
@@ -152,7 +152,7 @@ NSString *SOGoPasswordRecoverySecondaryEmail = @"SecondaryEmail";
rc = NO;
if ([fullName length])
[identity setObject: [fullName stringWithoutHTMLInjection: YES] forKey: @"fullName"];
[identity setObject: [fullName stringWithoutHTMLInjection: YES stripAngular:NO] forKey: @"fullName"];
if ([email length])
[identity setObject: email forKey: @"email"];
if ([replyTo length])
@@ -864,7 +864,7 @@ NSString *SOGoPasswordRecoverySecondaryEmail = @"SecondaryEmail";
if (mailIdentity && [mailIdentity objectForKey: @"fullName"]) {
fullName = [NSString stringWithString: [mailIdentity objectForKey: @"fullName"]];
if (fullName) {
[mailIdentity setObject: [fullName stringWithoutHTMLInjection: YES] forKey: @"fullName"];
[mailIdentity setObject: [fullName stringWithoutHTMLInjection: YES stripAngular:NO] forKey: @"fullName"];
[mailIdentities setObject: mailIdentity atIndexedSubscript: i];
}
}